AI Security Podcast How to Hack AI Applications: Real-World Bug Bounty Insights
17 snips
Apr 5, 2025 Join bug bounty hunter Joseph Thacker, who specializes in AI security, as he demystifies the evolving landscape of AI-powered applications. He shares real-world insights on unique vulnerabilities, like markdown image exfiltration and XSS in LLM responses. Discover why AI AppSec differs from traditional AppSec and how augmented human hackers currently outperform automated tools. Joseph also discusses the rise of hack bots and their limitations, offering a fascinating glimpse into the future of AI in cybersecurity.
AI Snips
Chapters
Transcript
Episode notes
Testing for XSS in AI Apps
- To test for XSS in AI apps, ask the LLM to respond with random XSS payloads outside markdown blocks.
- This helps uncover vulnerabilities stemming from the AI's output not being treated as potentially malicious.
AI in Penetration Testing
- AI can automate pen testing tasks, like generating XSS payloads, improving efficiency.
- AI-powered tools are helpful but still require human oversight for complex vulnerabilities.
Automating Tasks with AI
- Leverage AI for automating repetitive tasks like report writing and creating CSRF POCs.
- Joseph Thacker built a bot to convert HTTP requests to CSRF POCs and host them.